---
title: "Platform Overview"
description: "What Kliper is, how work is organised (Organization, Client, LOE, Assessment), and what the platform does."
version: "en"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.kliper.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform Overview

## What Is Kliper?

Kliper is a compliance assessment platform purpose-built for QSA firms and internal security teams conducting PCI DSS 4.0.1 assessments. It replaces spreadsheets, shared drives, and disconnected tooling with a single, auditable workspace that covers every phase of the ROC lifecycle — from engagement scoping through evidence collection to final report generation.

Every action taken inside Kliper is logged, every uploaded file is integrity-hashed and malware-scanned, and every requirement answer is traceable to the assessor who authored it.

## Core Data Hierarchy

Kliper organizes work in a strict four-level hierarchy. Understanding this hierarchy is essential for navigating the platform.

### Organization

An **Organization** represents your QSA firm or compliance team. It is the top-level tenant boundary.

- All users, clients, assessments, files, and billing are scoped to an organization.
- Each organization has its own storage quota (default 1 GB, configurable per subscription plan).
- Role-Based Access Control (RBAC) governs what each member can do: **Admin**, **Manager**, **Assessor**, **QA**, or **Viewer**.
- Organization administrators manage team invitations, integrations, and subscription billing.

### Client

A **Client** represents the merchant or entity being assessed. Client profiles capture the PCI-relevant context that carries through every engagement:

- **Company details** — legal name, DBA, address, website.
- **PCI context** — merchant level (1–4), estimated annual transaction volume, payment brands, last compliance date.
- **Primary contact** — name, phone, email for the client's point of contact.

A single organization can manage an unlimited number of clients. Each client can have multiple Letters of Engagement over time.

### Letter of Engagement (LOE)

An **LOE** defines the contractual and logistical scope of an engagement. It is the project container that sits between a client and one or more assessments.

| Field Group | What It Captures |
|---|---|
| **Scope** | Inclusions, exclusions, assessment locations, assessment type |
| **Financial** | Contract value, payment schedule, billing milestones |
| **Timeline** | Kickoff date, onsite dates, draft report date, remediation window, final report date |
| **QSA Signer** | Lead assessor name, credentials, certificate number |
| **Legal** | Liability cap, confidentiality terms, data handling provisions |
| **Status** | Draft, Active, Completed, Archived |

LOEs are created from the **Engagement Hub** and linked to exactly one client.

### Assessment

An **Assessment** is the core working unit of Kliper. It represents a single PCI DSS 4.0.1 evaluation conducted against the ROC framework.

When an assessment is created, the platform automatically loads the full set of PCI DSS testing procedures (200+ requirements across 12 principal sections). Assessors then work through each requirement using the **Assessment Workbench** — a structured interface for recording findings, uploading evidence, and collaborating with the team.

Each assessment tracks:

- **Answers** — one structured response per testing procedure, with status progression: `Pending` → `In Review` → `Approved` (or `Rejected`).
- **Evidence files** — uploaded documents, screenshots, configuration exports, and logs. Each file is SHA-256 hashed and malware-scanned on upload.
- **Collaborators** — team members assigned with specific roles (Editor or Viewer, plus the pinned Owner).
- **Messages** — threaded, requirement-scoped discussions with @mentions.
- **Tasks** — actionable work items (To Do, In Progress, Done) with assignees and due dates.
- **Audit trail** — every change recorded with timestamp, user identity, IP address, and old/new value snapshots.

Assessment statuses: `Scheduled`, `In Progress`, `Completed`, or `Cancelled`.

## Platform Capabilities at a Glance

| Capability | Description |
|---|---|
| **Assessment Workbench** | Section-tree navigation, structured answer forms, inline evidence, collapsible side panels for AI, comments, and attachments. |
| **Cortex AI** | In-context AI assistant that interprets PCI DSS requirements, validates uploaded evidence against requirement-specific criteria, and auto-generates ROC findings text. |
| **Scoping Engine** | Rules engine that conditionally hides or shows requirements based on the merchant's environment (e.g., no wireless technology → wireless requirements hidden). |
| **Evidence Management** | File uploads with SHA-256 integrity hashing, dual-engine malware scanning (ClamAV + VirusTotal), AI-powered document validation, and automatic metadata extraction. |
| **DOCX ROC Export** | One-click generation of a formatted Report on Compliance document from a Word template, with all assessment data populated into the correct sections. |
| **Real-time Collaboration** | Threaded comments with @mentions, live presence indicators, push notifications, and per-requirement audit logging. |
| **Engagement Phases** | Ordered workflow stages (kickoff, onsite, remediation, QA review) with task dependencies, hour estimates, and calendar integration. |
| **Gap & Risk Analysis** | Automated gap assessment to identify incomplete evidence, per-requirement risk scoring, and AI-generated remediation recommendations. |
| **Calendar** | Scheduling for meetings, milestones, and interviews with recurrence support and task linking. |
| **Admin Dashboard** | Activity logs, analytics, server health monitoring, audit trail, and 2FA management. |
| **Billing** | Subscription management billed through **Polar** (Merchant of Record) with Free, Solo, Pro, Team, and Enterprise plans. Plans meter **active client engagements**; usage tracking covers Cortex AI (messages, drafts, file summaries), DOCX exports, and storage. |

## Authentication and Access

Kliper uses cookie-based session authentication with support for:

- **Email/password** sign-up and sign-in.
- **OAuth providers** — Google, GitHub, and Microsoft.
- **Two-factor authentication (2FA)** — TOTP-based, with trusted device exemption.
- **Passkeys** — WebAuthn-based passwordless authentication.

All sessions are scoped to an organization via the `x-organization` header. Switching between organizations (for users who belong to multiple) is handled transparently in the UI.

## Security and Compliance

- [Security & AI Trust](/security-and-ai-trust) — How Kliper protects evidence integrity and how Cortex handles your data.
- [Subprocessors](/subprocessors) — The third parties that process data on Kliper's behalf.

Source: https://docs.kliper.dev/platform-overview/index.mdx